Ilia Denisov
6e03ce0131
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 22s
CI / integration (pull_request) Successful in 20s
CI / ui (pull_request) Successful in 1m10s
CI / conformance (pull_request) Successful in 10s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m57s
Accept real money via Telegram Stars (XTR) — the third intake rail alongside Robokassa (direct) and VK Votes. Only the bot reaches Telegram, so the rail funnels through the reverse mTLS bot-link: - the gateway mints the invoice on a CreateInvoice command (the bot calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice); - the bot gates each pre_checkout_query via a ValidatePreCheckout unary (the order must exist, be still creditable and not already paid — the reusable-invoice double-pay guard; the decline reason is localised to the order account's language); - a completed successful_payment is queued in a durable pure-Go SQLite outbox and forwarded via a ForwardPayment unary, credited once (idempotent on telegram_payment_charge_id, honours an expired order), re-driven on restart and every 30s. The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays inert until a chip pack carries an XTR price, so seeding a Stars price in the admin is the go-live. Tests: backend integration (order->forward->credit once, duplicate, pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) + executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the platform/telegram README, PLAN.
69 lines
3.2 KiB
YAML
69 lines
3.2 KiB
YAML
# Production Telegram bot host descriptor (standalone — NOT an overlay). Run only on
|
|
# the bot host:
|
|
# docker compose -f docker-compose.bot.yml up -d
|
|
#
|
|
# The bot egresses to the Bot API directly (no VPN sidecar) and dials the main host's
|
|
# published bot-link :9443 over mTLS. It exports no telemetry — otelcol lives on the
|
|
# main host and is unreachable from here — so observe it via `docker logs` on this host.
|
|
# Values come from the prod-deploy workflow (PROD_ secrets/variables); BOT_IMAGE is the
|
|
# pushed registry tag and BOTLINK_GATEWAY_ADDR is the main host's <ip>:9443.
|
|
name: scrabble-bot
|
|
|
|
services:
|
|
bot:
|
|
container_name: scrabble-telegram-bot
|
|
image: ${BOT_IMAGE:?set BOT_IMAGE to the registry tag}
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
environment:
|
|
TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:?set TELEGRAM_BOT_TOKEN}
|
|
TELEGRAM_GAME_CHANNEL_ID: ${TELEGRAM_GAME_CHANNEL_ID:-}
|
|
TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
|
|
# Support relay: a private forum supergroup the bot relays direct user messages
|
|
# into (one topic per user). 0/unset disables it; the bot needs admin there with
|
|
# the manage-topics and delete-messages rights.
|
|
TELEGRAM_SUPPORT_CHAT_ID: ${TELEGRAM_SUPPORT_CHAT_ID:-}
|
|
TELEGRAM_SUPPORT_STATE_DIR: /data
|
|
# The Telegram Stars payment outbox (shares the bot-state volume). A writable dir enables the
|
|
# Stars rail; empty disables it. The rail stays inert until a chip pack carries an XTR (Stars)
|
|
# price, so it is safe to leave on — seeding a Stars price in the admin is the real go-live.
|
|
TELEGRAM_STARS_OUTBOX_DIR: ${TELEGRAM_STARS_OUTBOX_DIR:-/data}
|
|
TELEGRAM_PROMO_BOT_TOKEN: ${TELEGRAM_PROMO_BOT_TOKEN:-}
|
|
TELEGRAM_BOT_USERNAME: ${TELEGRAM_BOT_USERNAME:-}
|
|
TELEGRAM_BOT_LINK: ${TELEGRAM_BOT_LINK:-}
|
|
TELEGRAM_PROMO_START_PARAM: ${TELEGRAM_PROMO_START_PARAM:-}
|
|
TELEGRAM_MINIAPP_URL: ${TELEGRAM_MINIAPP_URL:?set TELEGRAM_MINIAPP_URL}
|
|
# Real Bot API in prod (the test contour pins TELEGRAM_TEST_ENV=true instead).
|
|
TELEGRAM_TEST_ENV: "false"
|
|
TELEGRAM_API_BASE_URL: ${TELEGRAM_API_BASE_URL:-}
|
|
TELEGRAM_OWNS_UPDATES: "true"
|
|
# Dials the main host's published bot-link. ServerName stays `gateway` (the cert
|
|
# SAN), so TLS validation is independent of the dial address.
|
|
TELEGRAM_GATEWAY_ADDR: ${BOTLINK_GATEWAY_ADDR:?set BOTLINK_GATEWAY_ADDR (main:9443)}
|
|
TELEGRAM_BOTLINK_SERVER_NAME: gateway
|
|
TELEGRAM_BOTLINK_TLS_CERT: /certs/bot.crt
|
|
TELEGRAM_BOTLINK_TLS_KEY: /certs/bot.key
|
|
TELEGRAM_BOTLINK_TLS_CA: /certs/ca.crt
|
|
TELEGRAM_LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
TELEGRAM_SERVICE_NAME: scrabble-telegram-bot
|
|
# No telemetry export: otelcol is on the main host, unreachable from here.
|
|
TELEGRAM_OTEL_TRACES_EXPORTER: none
|
|
TELEGRAM_OTEL_METRICS_EXPORTER: none
|
|
GOMAXPROCS: "1"
|
|
volumes:
|
|
- ${SCRABBLE_CONFIG_DIR:-.}/certs:/certs:ro
|
|
# Support relay state (topic mapping, block list); survives redeploys.
|
|
- bot-state:/data
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1.0"
|
|
memory: 256M
|
|
|
|
volumes:
|
|
bot-state:
|